[openapi-mcp S10] Evidence-gate acceptance of introspection receipts (F4a)

[rickylabs]

Part of #1126

Scope

Evidence-gate integration, fork F4(a) as ratified: introspection receipts become accepted diagnostic evidence alongside doctor/otel in the #1078 machinery. F4(b) (receipts required for endpoint-shape drift claims) stays deferred one field wave and would need per-evidence-class receipt keys (resource, evidenceKind, operation) — new machinery, priced in RFC §9, not part of this issue.

Hard dependency — blocked by S8, and the reason must survive review: until the S-15 fix lands, a receipt is committed before output validation, so it can attest to output that never validated (and a throwing flow leaves a stale green receipt). Accepting such receipts as evidence first would import that defect directly into the #1078 evidence gate. Do not land this ahead of S8 under any sequencing pressure.

Design source: RFC #1123 (rfc.md §2.7F, §9 F4) + design/canonical/05-activation.md §2F (rev 2).

Acceptance

• gate: an introspection receipt written after S8's ordering fix satisfies the evidence gate; a pre-validation-style receipt cannot be produced by the shipped path

[github-actions]

Acceptance evidence mirrored from #1233.

• "gate: an introspection receipt written after S8's ordering fix satisfies the evidence gate; a pre-validation-style receipt cannot be produced by the shipped path" — Commit e3a5c0e: packages/mcp/tests/drift-evidence_test.ts exercises createMcpCliServer through public JSON-RPC. The success case calls list_api_services and proves its green receipt authorizes record_drift. The negative first creates green catalog evidence, then has a valid get_operation_schema result rejected by the shipped 64 KiB runner bound; the receipt becomes exitStatus 1 and public record_drift refuses. Focused 11/0 and package 109/0; opposite-family review PASS in the run artifact.

Provenance: updatedAt=2026-08-04T13:38:28Z; bodySha256=5cc33884e8ba50facdf8501ba28d739662d801d19deaf586cde5019d6ade6d11